Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.
{ "nvd_published_at": "2023-03-22T20:15:00Z", "github_reviewed_at": "2023-03-22T21:23:25Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-770" ] }